Overview

overview

10

Static

static

1

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b3cb2aeecc1b03b7e66fe264cb3c8ecee455cdf848a81ded6410e7d7a159acd

  • Size

    842KB

  • Sample

    240525-pmd7bsbb92

  • MD5

    108f13a6d63a28c9fe2cc5ef78f24a2f

  • SHA1

    7a044dea4d8abd141384fa4ca86f308ba9158d8f

  • SHA256

    5b3cb2aeecc1b03b7e66fe264cb3c8ecee455cdf848a81ded6410e7d7a159acd

  • SHA512

    48e5570fb1b4832c398252862777f0230e6a97ac0733c91c399908d20d3a0d82064f1e1ba82f1436dcd40d33759ec0c5e0c0dc26e4d4df43b24cf4435552088a

  • SSDEEP

    24576:jIRjCQiLuVC7RrxLQIiY+j1lLE18ROiYTeLgA:UIfaIdtLQIYZu18ROeLg

Score
10/10
smokeloaderpub4backdoortrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Targets

    • Target

      5b3cb2aeecc1b03b7e66fe264cb3c8ecee455cdf848a81ded6410e7d7a159acd

    • Size

      842KB

    • MD5

      108f13a6d63a28c9fe2cc5ef78f24a2f

    • SHA1

      7a044dea4d8abd141384fa4ca86f308ba9158d8f

    • SHA256

      5b3cb2aeecc1b03b7e66fe264cb3c8ecee455cdf848a81ded6410e7d7a159acd

    • SHA512

      48e5570fb1b4832c398252862777f0230e6a97ac0733c91c399908d20d3a0d82064f1e1ba82f1436dcd40d33759ec0c5e0c0dc26e4d4df43b24cf4435552088a

    • SSDEEP

      24576:jIRjCQiLuVC7RrxLQIiY+j1lLE18ROiYTeLgA:UIfaIdtLQIYZu18ROeLg

    Score
    10/10
    smokeloaderpub4backdoortrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks